GCVE-110-OSM-2026-9084

The package implements a staged payload execution pattern: `load_address_database()` reads `test_address_list.js`, strips `0x` prefixes from each line (indicating hex-encoded content), joins the result, base64-decodes it via `Buffer.from(result, 'base64')`, and passes the decoded bytes directly to `eval()`. This is a textbook technique for hiding an executable payload inside what appears to be a data file, bypassing static scanning of the main script. The `real_key = ""` variable adjacent to the eval call suggests a decryption step may be conditionally activated. The declared `axios` dependency is independently flagged as known-malicious on OSM, and the publisher email domain (`installer.ink`) is a suspicious low-reputation TLD associated with attacker infrastructure. The combination of new single-version package, no repository, brand-new publisher account, and this specific eval-of-decoded-file pattern is consistent with a Contagious Interview / supply-chain implant attacker model. ENTRY index.js (main: index.js) OBFUSCATION - Dynamic Base64 Decoding in index.js: "Buffer.from(result, 'base64')" - Deobfuscation Failed in index.js ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 1c18e094f05c8964a92facf9ef5b03a05dcd42d9e0b60a547f99a50db51deca6